CLAIMS 



RSW920040023US1 



We claim: 

1 . A method suitable for filtering events in an information technology resource monitor, 
comprising the steps of: 

determining a present count of occurrences of an event for a present monitoring 

period; 

comparing the present count with numbers of occurrences of the event in a 
plurality of earlier monitoring periods; 

invoking a first action if the present count exceeds a predetermined proportion of 
the numbers of occurrences of the event in the plurality of earlier monitoring periods; 
and 

invoking a second action if the present count does not exceed the predetermined 
proportion of the numbers of occurrences of the event in the plurality of earlier 
monitoring periods. 

2. The method of claim 1, wherein the predetermined proportion is a majority. 

3. The method of claim 1, wherein the second action includes logging the present count 
without taking further corrective action. 
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4. The method of claim 1, wherein the plurality of earlier monitoring periods all begin 
at the same times on consecutive days previous to the present monitoring period. 

5. A program storage device readable by a machine, tangibly embodying a program of 
instructions executable by the machine to perform method steps suitable for filtering 
events in an information technology resource monitor, said method steps comprising: 

determining a present count of occurrences of an event for a present monitoring 

period; 

comparing the present count with numbers of occurrences of the event in a 
plurality of earlier monitoring periods; 

invoking a first action if the present count exceeds a predetermined proportion of 
the numbers of occurrences of the event in the plurality of earlier monitoring periods; 
and 

invoking a second action if the present count does not exceed the predetermined 
proportion of the numbers of occurrences of the event in the plurality of earlier 
monitoring periods. 

6. A typicality filter suitable for filtering events in an information technology resource 
monitor, said filter comprising: 

an event counter for determining a present count of occurrences of an event for a 
present monitoring period; 
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a history table for storing numbers of occurrences of the event in earlier 
monitoring periods; and 

logic for comparing the present count with numbers of occurrences of the event 
in a plurality of earlier monitoring periods selected from the history table, invoking a 
first action if the present count exceeds a predetermined proportion of the numbers of 
occurrences of the event in the plurality of earlier monitoring periods, and invoking a 
second action if the present count does not exceed the predetermined proportion of the 
numbers of occurrences of the event in the plurality of earlier monitoring periods. 
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